NIS 20.x SRTSP.SYS (Real-time AutoProtect) High CPU and I/O Reads During Idle

I am using using NIS v. 20.4.0.40 (NIS 2013) with Vista 32-bit Home Premium.  After each idletime QuickScan, my CPU continues to run at approx. 20% and I can see my hard drive continuously thrashing until I take my system out of idle.  When I click inside the NIS Performance Graph the pop-up simply says "No Activity".

 

NIS 2013 No Activity During Idle 07 Nov 2013.jpg

Sysinternal's Process Explorer shows that the process SYSTEM (PID 4) and specifically Symantec's SRTSP.SYS (i.e., Symantec Real-time AutoProtect - TID 3624) is responsible for this high CPU activity during post-QuickScan idles.  The thrashing of my hard drive corresponds to a rapid increase in disk I/O reads by ccSvcHst.exe (PID 320), and depending on the amount of time my system remains in idle, these I/O reads by ccSvcHst.exe can exceed more than 20 million reads within a matter of hours after boot-up.

 

Proc Exp 07 Oct 2013.jpg

 

I performed a clean re-install of NIS v. 20.4.0.40 but this high activity by SRTSP.SYS during idles persists.  A search of the forum led me to a post here by elsewhere and shows that this issue with NIS 20.x also occurs with Win 7, etc.

Does anyone know if Symantec is planning to fix this issue in NIS 20.x, or if the same problem has been reported in NIS 21.x?
------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Hi Imacri,

 

I would suggest that you move to NIS v.21 asap...

Things are far better with NIS 21.

 

Regards,

I am using using NIS v. 20.4.0.40 (NIS 2013) with Vista 32-bit Home Premium.  After each idletime QuickScan, my CPU continues to run at approx. 20% and I can see my hard drive continuously thrashing until I take my system out of idle.  When I click inside the NIS Performance Graph the pop-up simply says "No Activity".

 

NIS 2013 No Activity During Idle 07 Nov 2013.jpg

Sysinternal's Process Explorer shows that the process SYSTEM (PID 4) and specifically Symantec's SRTSP.SYS (i.e., Symantec Real-time AutoProtect - TID 3624) is responsible for this high CPU activity during post-QuickScan idles.  The thrashing of my hard drive corresponds to a rapid increase in disk I/O reads by ccSvcHst.exe (PID 320), and depending on the amount of time my system remains in idle, these I/O reads by ccSvcHst.exe can exceed more than 20 million reads within a matter of hours after boot-up.

 

Proc Exp 07 Oct 2013.jpg

 

I performed a clean re-install of NIS v. 20.4.0.40 but this high activity by SRTSP.SYS during idles persists.  A search of the forum led me to a post here by elsewhere and shows that this issue with NIS 20.x also occurs with Win 7, etc.

Does anyone know if Symantec is planning to fix this issue in NIS 20.x, or if the same problem has been reported in NIS 21.x?
------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Hi Imacri, I know you must have a very good reason for staying with v 20, but I downloaded v 21 on the day of release, and it's working fine on my machines.  One laptop and one desktop, both on v 21. No thrashing, here !.....:smileyhappy: You can always revert, if you aren't happy with v 21.


 

Does anyone know if Symantec is planning to fix this issue in NIS 20.x, or if the same problem has been reported in NIS 21.x?


 

Hi lmacri

 

The issue is still present in version 21, as reported below:

 

http://community.norton.com/t5/Norton-360-Norton-Internet/SRTSP-SYS-CPU-usage-labelled-as-No-Activity/m-p/1028415/highlight/true#M1580

 

(Transient link reproduced below)

SRTSP.SYS CPU usage labelled as 'No Activity'

‎27-09-2013 06:58 PM

 

After an Idle Quick Scan, a Norton 'SRTSP.SYS' thread will continue running under the 'System' process, as shown by the blue-coloured, 'No Activity' selection highlighted during an Idle Time period on the graph below. Please note the 22.73 percent CPU usage by this thread in the Process Explorer window below. Full details regarding the issue can be found in my previous post here:

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/Norton-Performance-Monitor/m-p/880618...

 

 

NIS NIS 21-0-1-3 System Insight SRTSP CPU No Activity.png

 

 

 

NIS NIS 21-0-1-3 SRTSP Thread CPU usage.png

 

Please investigate and resolve.

 

Thanks

 

Norton Internet Security 21.0.1.3 Windows 7 Home Premium 7601.18205.x86fre.win7sp1_gdr.130708-1532

 

 

 

 


elsewhere wrote:

The issue is still present in version 21, as reported below:

 

http://community.norton.com/t5/Norton-360-Norton-Internet/SRTSP-SYS-CPU-usage-labelled-as-No-Activity/m-p/1028415/highlight/true#M1580


Hi elsewhere:

Thank you for letting me know that the high CPU usage by SRTSP.SYS after QuickScans also occurs in NIS 21.x. - at least for those of us who reported this issue with NIS 20.x.  Have you tried upgrading to NIS v. 21.1.0.18 to see if this problem persists in the latest version?

I posted about this problem here back in Dec 2012 but that thread degenerated so badly that the forum administrator had to lock the thread to prevent further discussion.  I noticed that the link you provided to another thread on the same topic here suffered a similar fate before anyone from Symantec could provide input.


I'd be happy to run further diagnotics or provide memory dumps if anyone from Symantec is interested in pursuing this.
------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Imacri and elsewhere, I've passed this on to Symantec for investigation.


lmacri wrote:

elsewhere wrote:

The issue is still present in version 21, as reported below:

 

http://community.norton.com/t5/Norton-360-Norton-Internet/SRTSP-SYS-CPU-usage-labelled-as-No-Activity/m-p/1028415/highlight/true#M1580


Hi elsewhere:

Thank you for letting me know that the high CPU usage by SRTSP.SYS after QuickScans also occurs in NIS 21.x. - at least for those of us who reported this issue with NIS 20.x.  Have you tried upgrading to NIS v. 21.1.0.18 to see if this problem persists in the latest version?

[...]


Hi lmacri

 

Sorry for the delay; the issue is still present in NIS v. 21.1.0.18 under Windows 7:

 

NIS 21-1-0-18 SRTSP No Activity.png

 

The important point to note here is that the 'No Activity' SRTSP.SYS CPU usage, after an Idle Quick Scan, actually ends under Windows 7, as shown by the blue inverted triangle above.

 

Under Vista 32-bit Home Premium however, I'm actually seeing worse results than the ones you described here:

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/NIS-20-x-SRTSP-SYS-Real-time-AutoProtect-High-CPU-and-I-O-Reads/m-p/1047473/highlight/true#M248261

 

For me, the 'No Activity' process locks around 50 percent of the CPU (1 of 2 cores). After an Idle Quick Scan, the only way for me to stop Norton's idle 'No Activity' CPU usage is to reboot the PC.

 

Does Norton's idle 'No Activity' CPU usage actually end for you on your PC if you let it continue unabated?

 

Please advise.

 

Thanks

 

 

 

Any chance this is disk optimization occurring? It may not show up as a Norton task  as it uses the Windows defrag routine.

 

 

 


elsewhere wrote:

 

Under Vista 32-bit Home Premium however, I'm actually seeing worse results than the ones you described here:

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/NIS-20-x-SRTSP-SYS-Real-time-AutoProtect-High-CPU-and-I-O-Reads/m-p/1047473/highlight/true#M248261

 

For me, the 'No Activity' process locks around 50 percent of the CPU (1 of 2 cores). After an Idle Quick Scan, the only way for me to stop Norton's idle 'No Activity' CPU usage is to reboot the PC.



Hi elsewhere:

I haven't monitored this idletime activity by SRTSP.SYS closely enough on my 32-bit Vista machine to make a definitive statement, but the behaviour depends largely on how long my idletime lasts.  If I change my power settings to prevent my system from going into sleep mode and force a prolonged idle, this period of "No Activity" continues as long as my system remains in idle - see my screenshot in message # 1. The activity stops when I take my system out of idle and typically does not start again at the next idle.

If I use my default power setting so that my system normally goes into sleep mode after 25 min of inactivity, idletime activity by SRTSP.SYS runs every time my system goes into idle, stopping when I take my system out of idle, and starting again at each subsequent idle.  I think sleep mode is enough to halt this continuous cycling of activity by SRTSP.SYS during idles, but I'm not sure about that and it's possible that a boot-up is necessary to stop the cycling.

I've only noticed one occassion where this idletime activity by SRTSP.SYS appeared to stop of it's own accord on my 32-bit Vista system.  I ran a manual full system scan on 31-Oct-2013 and the SRTSP.SYS activity terminated by itself.  I seem to recall checking my Norton tasks and confirmed that an automatic QuickScan ran just as the full system scan was completing.  Sorry, my screenshot below from 31-Oct-2013 didn't capture the graph's pop-up but I did confirm that this was another period of high CPU usage labelled as "No Activity" and not due to some other non-Norton process like the Windows File Indexing or Windows Disk Defragmenter.

 

NIS 2013 No Activity During Idle Edited 31 Oct 2013.jpg

------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS


peterweb wrote:

 

Any chance this is disk optimization occurring? It may not show up as a Norton task  as it uses the Windows defrag routine.


Hi peterweb:

 

Norton's Idle Time Optimizer is disabled in my settings and my Norton Tasks window confirms that the Insight Optimizer task has never run on my machine.

 

Norton Tasks Insight Optimizer 15 Oct 2013.jpg

 

 

If a Windows process like Windows Disk Defragmenter (dfrgntfs.exe for 32-bit Vista) runs during idle the process will be correctly identified in the activity graph pop-up.  The pop-up for a QuickScan or Full System Scan will correctly identify the process as ccSvcHst.exe (not NIS.exe, since I use NIS v. 20.4.0.40) and CPU activity by ccSvcHst.exe will correctly display as yellow, (not blue) peaks in the graph.

 

NIS 2013 dfrgntfs During Idle Edited 20 Sep 2013.jpg

 

 

Since these periods of "No Activity" consistently occur after idletime QuickScans, all I have to do is start real-time monitoring in Process Explorer, adjust my power settings to delay sleep mode, open the Norton Performance window and wait for a QuickScan to run during idle.  The 20-25% CPU usage (and high I/O disk reads) by "No Activity" (or to be precise, 1% by Process Explorer, 19-25% unaccounted for by "No Activity") in the Norton Performance graph following the QuickScan always corresponds to 20-25% CPU usage by SRTSP.SYS in Process Explorer as shown in message # 1.

 

NIS 2013 No Activity After Quick Scan 11 Jan 2012.jpg

------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 25.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

... bump.

 

I'm still curious if Symantec has any explanation as to why some NIS 20.x (2013) and NIS 21.x (2014) users are seeing this high CPU and disk I/O activity by SRTSP.SYS (Symantec Real-time AutoProtect) during system idles that is labeled as "No Activity" in the Performance graph.

 

Since this high activity always seems to follow a Quick Scan, is this a case of a NIS scan not terminating correctly?  Could I have some third-party software running in the background (e.g., a network monitoring program) that "wakes up" NIS real-time protection after a Quick Scan?  Just FYI, NIS is the only AV software running in real-time protection mode on this computer.

 

Here's another screenshot from yesterday showing how these disk read/writes labeled as "No Activity" temporarily pause when I take my system out of idle.

 

NIS 2013 No Activity During Idle EDIT 11 Dec 2013.jpg

------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 26.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Imacri,

 

Be sure to have a complete System backup Image because in my case, this activity corrupted the taskbar and some other Windows essential files.

At the end, the idle Quick Scans finished after 3-4 mins and the activity continued for at least 10-15 more mins.

I suggest that you uninstall NIS each time this activity occurs before a major problem with the OS starts.

I hope that it will be fixed asap because if it is happening again on my W7 systems my comments for Symantec here  will be very ugly.

If Symantec cannot fix it then give us the ability to disable the idle Quick scans.

Have an excellent day.

 

Regards,

Hi, all. Send of Jive made the point here,

 

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/NIS-2013-NIS-exe-uses-all-CPU-on-winXP/m-p/1061081/highlight/true#M250086

 

 

I wonder if that's what's causing the spikes in YOUR cases ? As mentioned, the actual monitoring seems to cause spikes ?

Hi F4E,

 

I wondered the same thing - however, if the Performance window were left open the Norton activity would be shown as yellow, so I think this issue is probably something different.

 

No doubt it's a simple solution, SOJ. That's why I can't figure it !......:smileywink:


F4E wrote:
I wonder if that's what's causing the spikes in YOUR cases ? As mentioned, the actual monitoring seems to cause spikes ?

Hi F4E:

 

I re-labeled the screenshot I first posted in message # 12 to show that this constant disk thrashing by SRTSP.SYS during idles is esssential the same regardless of whether the NIS GUI is open or closed.

 

NIS 2013 No Activity During Idle New EDIT 11 Dec 2013.jpg

 

In the idle period labeled "A" when the GUI was open and I was monitoring the Performance graph in real-time, the pop-up in that part of the graph showed that ccSvcHst.exe was responsible for 1% of the total CPU (in yellow along the baseline), but the remaining ~ 15% of the total CPU (in blue) was this "hidden" activity by SRTSP.SYS. 

 

In the idle period labeled "B" when the GUI was closed all ~ 15% of the total CPU was this blue "No Activity" by SRTSP.SYS.

 

The constant disk read/writes during idles by this "hidden" SRTSP.SYS activity that elsewhere and I are describing in this thread looks similar to what Cooloutac reported here but quite different from the yellow spikes of NIS.exe activity described by Steve_C here

------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 26.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Ongoing problem for some, either way. I can't say I've ever had this problem. Maybe I've been lucky ?......:smileyhappy:

 

Could it have anything to do with system differences ? Vista 32 bit, or Windows 7 64 bit. Or am I grasping at straws ?

 

I believe Norton is optimised for either ?


F4E wrote:

 

Could it have anything to do with system differences ? Vista 32 bit, or Windows 7 64 bit.


The problem doesn't appear to be related to the bit architecture of the OS.  I use 32-bit Vista while Cooloutac and elsewhere use 64-bit Win7.  All three of us noticed the problem after we upgraded to NIS 20.x (2013) and elsewhere reported that the problem persists in NIS 21.x (2014).  elsewhere and I used Sysinternal's Process Explorer and independently came to the same conclusion that this post-Quick Scan idletime disk thrashing displayed as "No Activity" in the NIS Performance graph is caused by SRTSP.SYS (Symantec Real-time AutoProtect).

 

I have wiped and re-installed NIS v. 20.4.0.40 twice, essentially following the steps posted here by Phil_D (i.e., selecting "Please remove all user data" during the Control Panel uninstall followed by multiple re-boots and wipes with the Norton Removal Tool) and the idletime disk thrashing persists.

------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 26.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Hi Imacri,

 

I had the same issue with both my W7 x64 machines but after an idle quick scan which I know from experience that it takes about 3-5 mins I used to suspend the prolonged SRTSP activity by using my keyboard.

However, I made the huge mistake to let it finished itself the past 3-4 weeks and at one moment during a shutdown I had for the first time the dimmed screen message from W7 "NIS.exe, the referenced instruction at 0xxxxxxxxx could not be read by memory etc. Click OK to terminate the program" which is basically a warning that NIS 21 died and an uninstall process with NRT is more or less required.

This is the main reason why I stated in a previous message that it is essential that you have a complete System image backup before any trouble arises.

Once again, if Symantec is too busy to look at this and resolve, it would be great news if in the upcoming version update, the ability to manually disable the idle Quick Scans is offered, because the problem starts after an idle quick Scan finishes. (Not immediately after product installation, but after an estimated period of 2-3 weeks, at least for my machines).

 

Kind regards,